3 ms·
In addition to being able to add multiple devices, there are recovery scenarios that would ostensibly fall outside of the scope of WebAuthn. A service using Web
by Freak_NL 8y ago
In addition to being able to add multiple devices, there are recovery scenarios that would ostensibly fall outside of the scope of WebAuthn. A service using WebAuthn could give you a set of one time use high-entropy codes that can be printed and stored in a safe location. When you use those code to gain access to an account for which you have lost your token(s), you would of course get an e-mail letting you know that someone (you in this case) did that.
- MrStonedOne 8y agowebauthn has to solve the problem, or the problem will still exist and will stop mass adoption.
- unimpressive 8y agoNot necessarily, it just has to not preclude a de facto standard solution. And it doesn't. The scheme described by OP above sounds fairly sane without compromising the overall security of the system (in the way that e.g, password reset forms and security questions do).
- MrStonedOne 8y agoNo, its a shitty way of doing it that will never work in practice. Nobody will remember where those are. They will likely download the pdf, store it in downloads, where it will be used by some Trojan to hijack their account, or they will lose it during a device switch or some dataloss event. Telling people to store one time codes securely and reliably, for every single account they own, and telling them that will only work for the services that bothered to add that on to their implantation of the standard, works for techys, but not the overall populous.
- ehsankia 8y agoHow is losing your key any different from losing your password? "Password" doesn't try to solve the problem of losing your password, that's beyond the scope. All recovery methods that apply to passwords also apply here.